The U.S. State Department has approved a potential $105 million Foreign Military Sale to Ukraine for the modernization and sustainment of its Patriot air defense systems, according to a notification released by the Defense Security Cooperation Agency (DSCA). The proposed sale includes an upgrade of Ukraine’s current M901 launchers to the newer M903 configuration, enabling […] 
Given that we live in the proverbial glass house, we can’t throw stones at [ellis.codes] for modifying a perfectly fine Vornado fan. He’d picked that fan in the first place because, unlike most fans, it had a DC motor. Of course, DC motors are easier to control with a microcontroller, and next thing you know, it was sporting an ESP32 and a WiFi interface.
The original fan was surprisingly sparse inside. A power supply, of course, and just a tiny PCB for a speed control. Oddly, it looks like the speed control was just a potentiometer and a 24 V supply. It wasn’t clear if the “motor” had some circuitry in it to do PWM control or not. That seems likely, though.
Regardless, the project opted for a digital pot IC to maintain compatibility. One nice thing about the modification is that it replaces the existing board with the same connectors. So if you wanted to revert the fan to normal, you simply have to swap the boards back.
Now the fan talks to home automation software. Luckily, there’s still nothing wrong with it. We love seeing bespoke ESPHome projects. Even if your fan has WiFi, you might not like it communicating with Big Brother.
Let's say you have several hundred IoT devices publishing telemetry data to your MQTT broker and things have been working smoothly for months. One morning you notice half of the sensor readings have stopped arriving. Your monitoring dashboard becomes a black hole, your automation stops working, and you can't determine whether the problem is with the devices, the network, or the MQTT broker.
As Internet of Things (IoT) devices continue to permeate every aspect of modern life, homes, offices, factories, vehicles, their attack surfaces have become increasingly attractive to adversaries. The challenge with testing IoT systems lies in their complexity: these devices often combine physical interfaces, embedded firmware, network services, web applications, and companion mobile apps into a [...]
The post IoT Penetration Testing: From Hardware to Firmware appeared first on Hacking Tutorials.
By Antoinette Hodes, Office of the CTO, Check Point Software Technologies.
The dark web has evolved into a clandestine marketplace where illicit activities flourish under the cloak of anonymity. Due to its restricted accessibility, the dark web exhibits a decentralized structure with minimal enforcement of security controls, making it a common marketplace for malicious activities.
The Internet of Things (IoT), with the interconnected nature of its devices, and its vulnerabilities, has become an attractive target for dark web-based cyber criminals. One weak link – i.e., a compromised IoT device – can jeopardize the entire network’s security. The financial repercussions of a breached device can be extensive, not just in terms of ransom demands, but also in terms of regulatory fines, loss of reputation and the cost of remediation.
With their interconnected nature and inherent vulnerabilities, IoT devices are attractive entry points for cyber criminals. They are highly desirable targets, since they often represent a single point of vulnerability that can impact numerous victims simultaneously.
Check Point Research found a sharp increase in cyber attacks targeting IoT devices, observing a trend across all regions and sectors. Europe experiences the highest number of incidents per week: on average, nearly 70 IoT attacks per organization.
Based on research from PSAcertified, the average cost of a successful attack on an IoT device exceeds $330,000. Another analyst report reveals that 34% of enterprises that fell victim to a breach via IoT devices faced higher cumulative breach costs than those who fell victim to a cyber attack on non-IoT devices; the cost of which ranged between $5 million and $10 million.
Other examples of IoT-based attacks include botnet infections, turning devices into zombies so that they can participate in distributed denial-of-service (DDoS), ransomware and propagation attacks, as well as crypto-mining and exploitation of IoT devices as proxies for the dark web.
The dark web relies on an arsenal of tools and associated services to facilitate illicit activities. Extensive research has revealed a thriving underground economy operating within the dark web. This economy is largely centered around services associated with IoT. In particular, there seems to be a huge demand for DDoS attacks that are orchestrated through IoT botnets: During the first half of 2023, Kaspersky identified over 700 advertisements for DDoS attack services across various dark web forums.
IoT devices themselves have become valuable assets in this underworld marketplace. On the dark web, the value of a compromised device is often greater than the retail price of the device itself. Upon examining one of the numerous Telegram channels used for trading dark web products and services, one can come across scam pages, tutorials covering various malicious activities, harmful configuration files with “how-to’s”, SSH crackers, and more. Essentially, a complete assortment of tools, from hacking resources to anonymization services, for the purpose of capitalizing on compromised devices can be found on the dark web. Furthermore, vast quantities of sensitive data are bought and sold there everyday.
Adversarial machine learning can be used to attack, deceive and bypass machine learning systems. The combination of IoT and AI has driven dark web-originated attacks to unprecedented levels. This is what we are seeing:
The convergence of IoT and AI brings numerous advantages, but it also presents fresh challenges. To enhance IoT security and device resilience while safeguarding sensitive data, across the entire IoT supply chain, organizations must implement comprehensive security measures based on zero-tolerance principles.
Factors such as data security, device security, secure communication, confidentiality, privacy, and other non-functional requirements like maintainability, reliability, usability and scalability highlight the critical need for security controls within IoT devices. Security controls should include elements like secure communication, access controls, encryption, software patches, device hardening, etc. As part of the security process, the focus should be on industry standards, such as “secure by design” and “secure by default”, along with the average number of IoT attacks per organization, as broken down by region every week.
Collaborations and alliances within the industry are critical in developing standardized IoT security practices and establishing industry-wide security standards. By integrating dedicated IoT security, organizations can enhance their overall value proposition and ensure compliance with regulatory obligations.
In today’s cyber threat landscape, numerous geographic regions demand adherence to stringent security standards; both during product sales and while responding to Request for Information and Request for Proposal solicitations. IoT manufacturers with robust, ideally on-device security capabilities can showcase a distinct advantage, setting them apart from their competitors. Furthermore, incorporating dedicated IoT security controls enables seamless, scalable and efficient operations, reducing the need for emergency software updates.
IoT security plays a crucial role in enhancing the Overall Equipment Effectiveness (a measurement of manufacturing productivity, defined as availability x performance x quality), as well as facilitating early bug detection in IoT firmware before official release. Additionally, it demonstrates a solid commitment to prevention and security measures.
By prioritizing dedicated IoT security, we actively contribute to the establishment of secure and reliable IoT ecosystems, which serve to raise awareness, educate stakeholders, foster trust and cultivate long-term customer loyalty. Ultimately, they enhance credibility and reputation in the market. Ensuring IoT device security is essential in preventing IoT devices from falling into the hands of the dark web army.
This article was originally published via the World Economic Forum and has been reprinted with permission.
For more Cyber Talk insights from Antoinette Hodes, please click here. Lastly, to receive stellar cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.
The post How the Internet of Things (IoT) became a dark web target – and what to do about it appeared first on CyberTalk.
Introduction Although there are multiple definitions widely for ‘Internet of Things(IoT)’, but for purposes of this blog series we will be going ...
The post IoT Threat Modelling appeared first on HackNos.
n
The post Should we regulate the Internet of Things? appeared first on Detectify Blog.
Over the course of 2018, Radware’s Emergency Response Team (ERT) identified several cyberattacks and security threats across the globe. Below is a round-up of our top discoveries from the past year. For more detailed information on each attack, please visit DDoS Warriors. DemonBot Radware’s Threat Research Center has been monitoring and tracking a malicious agent […]
The post Top 6 Threat Discoveries of 2018 appeared first on Radware Blog.
With the growing online availability of attack tools and services, the pool of possible attacks is larger than ever. Let’s face it, getting ready for the next cyber-attack is the new normal! This ‘readiness’ is a new organizational tax on nearly every employed individual throughout the world. Amazingly enough, attackers have reached a level of […]
The post New Threat Landscape Gives Birth to New Way of Handling Cyber Security appeared first on Radware Blog.
Companies are beginning to realize that the location of their employees and the devices they use are not as important as they used to be. The work culture will be more about what you do and not where you do it. In 2023, a hybrid world begins to develop where the barriers of the digital and real world will disappear. With flexibility being a priority for businesses and ordinary users, they face the challenge of user security and privacy as they easily change their location with multiple devices and networks and use different communication platforms. One of the most important trends that will dominate in 2023 is political or social attacks and state-sponsored cyberattacks. Political attacks can quickly damage businesses, industries, and economies, as well as cause unrest in a region.
The cloud platform and the Zero Trust method are the perfect combination to increase the security of access to every user and device, regardless of their local location. In 2023, this cybersecurity method will be actively implemented.
Clive Harby said in 2006 that this data is the new oil, but it is now routinely shared by vendors, customers and businesses. Zero Trust’s main goal is to protect this strategic asset from falling into the wrong hands.
As the use of artificial intelligence and machine learning evolve, we’re seeing new cybersecurity solutions emerge more often and help identify and respond to threats in real time. Such technologies will help organizations find and avoid attacks. Many expect technology to facilitate faster and more accurate responses to possible threats as the threat landscape evolves.
The emergence of quantum-type computers also indicates that the vulnerability of traditional forms of encryption is increasing. As a result, researchers have developed new quantum-resistant forms of security that can protect advanced computing systems. These new technologies will be crucial to securing sensitive information and methods over the coming years.
Companies, too, are beginning to view blockchain as something more than cryptocurrency. Blockchain is expected to be used to create new, innovative solutions to protect cyberspace. For example, blockchain systems can provide more secure verification of a user’s identity, and blockchain-based data stores can help protect against data leakage.
As the threat continues to grow, government and regulators are setting requirements for organizations to create appropriate cyber defenses. In 2023, expect an increased focus on cybersecurity regulation and compliance and the implementation of new requirements and guidelines to help organizations protect their system data.
As more and more devices connect to the Internet, IoT devices are becoming a serious problem. As a result, new technology is being developed to protect IoT devices from manipulation. This will be especially important in healthcare, where the security of medical devices is important.
In 2023, cyber threats will emerge in a new world, and many companies will actively use the latest technology to provide cyber protection. As a result, it is safe to assume that this trend and development will play an important role in strengthening information security in general.
Login
